Before a contractor finishes a project, agree what should happen to their account and who will confirm that their access is no longer needed. Leaving those questions until afterward makes it easier for access to remain in place without anyone deciding whether it should.
An employee who moved out of bookkeeping may still be able to open payroll files because nobody removed the old permission. Compare what each person can open today with the work they do now, and ask about access that no longer fits their job.
Match access to each role.
Start by asking which files a person needs for their job, such as customer records for sales or payroll files for bookkeeping. Do they need to read those files, change them, or both? Use those answers to decide which applications and folders they should be able to open.
Revisit existing access when responsibilities change. Someone might still need their email account while no longer needing particular business records, so agree what should remain available and what should be removed with the appropriate person in the business.
Review licensing at the same time, asking why each license is assigned and which required applications or features it provides. Include unused accounts in that review so you understand the reasons behind the subscriptions the business keeps.
Organize shared files and permissions.
Use SharePoint for shared business files and OneDrive for individual work files. Agree where documents used across the business should live, then check who can access those locations so employees know where to find information and whether they’re allowed to open it.
Agree who can approve access to a shared folder and who can send file links to people outside your business. An employee may need to read a customer document without being allowed to share it with a supplier or another outside contact.
Keep a record of the answers to these questions:
- Where should employees find shared business information?
- Who can approve a request to open or change files in each shared folder?
- When someone changes jobs or leaves, which shared folders should they stop being able to open or change?
If the person who organizes invoices is away, could someone else find the files and open them? Agree where those documents belong and who should have access, so finding the next invoice doesn’t depend on one person being available.
Use an onboarding and offboarding checklist.
Before an account is created, record the applications, file access, groups, and subscriptions needed for the role, along with when the person needs to start using them. That gives account setup a clear set of requirements.
When someone moves from sales to another job, ask which customer folders they still need and which files they need for the new role. Review the old permissions alongside the new ones so adding access doesn’t mean forgetting to remove what’s no longer needed.
When someone leaves, decide who needs their work files and what should happen to their mailbox. Ask which sign-ins and folder permissions need to be removed and whether the license is still needed. Put a person’s name beside each task so the account changes actually get done.
Connect support and security.
Tell employees where to ask for help if they can’t sign in or open a file. If they need access to another folder, explain who in the business can approve it, so a password reset and permission to read payroll records don’t get treated as the same request.
When you add or remove someone’s access to a folder, update your own record of what changed and why. If they ask for access again, you can check whether they still do the job that required it.
Geekland IT handles Microsoft 365 account changes for onboarding, offboarding, and role changes, and clients request them through the ticket form in the Client portal. Microsoft 365 licensing can be added if you need it.
Back to resources